Interpretable Scheme Generation Method Based on Causal Reasoning Graph and Large Language Model

Abstract

An interpretable solution generation method based on causal reasoning graphs and large language models is proposed, characterized by: Step 1: generating solution tasks according to requirements; Step 2: introducing a causal model to more accurately characterize the decision-making environment; Step 3: adding causally identifiable optimal interventions to generate solutions. This application proposes an interpretable solution generation method based on causal reasoning graphs and large language models. This method combines the structured causal reasoning capabilities of causal reasoning graphs with the natural language generation capabilities of large language models. Reasoning graphs, with events as nodes and relationships between events as edges, can describe the evolutionary patterns of dynamic processes. To support causal reasoning, this application further introduces causal structures to construct causal reasoning graphs.

Description

Technical Field

[0001] This invention relates to the field of causal artificial intelligence, and in particular to a method for generating interpretable schemes based on causal reasoning graphs and large language models. Background Technology

[0002] Generating feasible and reliable action plans is one of the core tasks in complex decision-making scenarios (such as emergency response, medical diagnosis, and technology impact assessment). Traditional solution generation methods often rely on expert systems or predefined rules, making it difficult to cope with open and dynamic environments. In recent years, large language models have shown great potential in solution generation tasks due to their powerful semantic understanding and generation capabilities. However, generation methods driven solely by large language models have two fundamental drawbacks: firstly, a lack of interpretability—the generation process is like a "black box," making it difficult to trace the basis of decisions; secondly, insufficient causal consistency—the generated solutions may violate basic causal laws, leading to actual execution failure.

[0003] In the fields of artificial intelligence and decision science, solution generation is a fundamental and crucial task. Traditionally, solution generation is defined as generating an ordered sequence of actions given an initial state and a target state, such that executing this sequence from the initial state will reach or approximate the target state. However, in complex decision-making scenarios such as emergency response and medical diagnosis, simply generating executable action sequences is far from sufficient. An effective solution must also rigorously consider the complex causal dependencies between actions and assess the systematic impact of actions on the external environment to avoid solution failure due to violations of causal logic or unforeseen side effects. Existing solution generation methods (such as rule-based expert systems or the recently emerging large language model generation methods) have significant limitations in this regard: the former struggles to model complex causality in open and dynamic environments, while the latter, due to the lack of interpretable causal reasoning in the generation process, often produces solutions that violate common sense or causal laws.

[0004] Plan generation refers to generating an ordered sequence of actions given an initial state and a target state, such that executing this sequence from the initial state will reach or approximate the target state. In complex decision-making scenarios, plans must consider not only the feasibility of actions but also the causal dependencies between actions and their impact on the external environment.

[0005] Definition 1: A solution generation task is a quintuple. ,in:

[0006] It is a state space, and each state It describes the values ​​of relevant variables in the decision-making scenario;

[0007] It is the space for action, each action It corresponds to one executable operation;

[0008] It is the initial state;

[0009] The goal is usually represented as a predicate about a state. This indicates whether the goal has been achieved.

[0010] It is a set of constraints, including resource constraints, timing constraints, causal constraints, etc.

[0011] A solution It is a sequence of actions. Execution plan. From the initial state Starting from this point, actions are applied sequentially to generate state transitions:

[0012]

[0013] The plan will succeed if and only if .

[0014] However, traditional planning frameworks are insufficient in modeling causal relationships. The effects of actions are often simplified into deterministic state transition functions, failing to handle causal interactions between actions and the influence of unobserved confounding factors. Therefore, causal models are needed to more accurately characterize the decision-making environment.

[0015] A knowledge graph is essentially a "relationship network" that machines can understand. It organizes things (entities) in the real world and the relationships between them in the form of a graph structure (nodes and edges), building a structured semantic knowledge base.

[0016] An Event Logic Graph (ELG) is a graph-structured knowledge representation model that uses events as the basic unit to describe the logical relationships between events, such as causality, sequence, and conditions.

[0017] Although both knowledge graphs and event logic graphs are graph structures, their modeling objects and application logic are completely different. Simply put: a knowledge graph is a "static network of entity relationships," while an event logic graph is a "dynamic network of event evolution."

[0018] In complex decision-making (such as emergency response and medical diagnosis), the two are often complementary. In particular, event graphs, by depicting the temporal, causal, and conditional relationships between events, can support event chain-based reasoning and planning. Summary of the Invention

[0019] To address the above technical issues, this application proposes a method for generating interpretable schemes based on causal reasoning graphs and large language models.

[0020] This method combines the structured causal reasoning capabilities of the causal reasoning graph with the natural language generation capabilities of the large language model, transforming solution generation into a problem of finding the optimal causal intervention on the reasoning graph.

[0021] An interpretable scheme generation method based on causal reasoning graphs and large language models is described below:

[0022] Step 1: Generate a solution task based on the requirements;

[0023] Step 2: Introduce a causal model to more accurately characterize the decision-making environment and construct an offline causal event graph;

[0024] Step 3: Incorporate the causally identifiable optimal intervention scheme to generate an online causally identifiable scheme;

[0025] The steps for constructing an offline causal event graph are as follows: Based on the domain corpus, events are extracted and normalized using a large language model to construct event nodes, and causal relationships are extracted and fused under the guidance of the large language model to construct causal edges, thus forming a structured causal event graph.

[0026] The steps for generating an online causal identifiable solution are as follows: Based on the causal event graph, the set of interventionable events is pruned for causal identifiability; the optimal intervention solution is searched on the pruned intervention set; and the optimal intervention solution is transformed into a natural language solution with causal explanation.

[0027] Step two includes the following steps:

[0028] 1) Use a large language model to extract events from the domain corpus and perform semantic normalization to obtain a standardized set of event nodes;

[0029] 2) Employ a large language model to simulate multiple expert roles, and make causal judgments on event pairs from multiple dimensions such as time sequence, mechanism, condition, and counterfactual, and extract causal relationships with confidence to construct a preliminary causal edge set;

[0030] 3) Perform conflict resolution and directed acyclic graph optimization on the preliminary causal edge set, and learn the structure function of the events to form a causal event graph that conforms to the form of a structural causal model.

[0031] Step three includes the following steps:

[0032] 1) Based on the backdoor criterion or the frontdoor criterion, select a subset of interventions with identifiable causal effects from the set of interventionable events as a candidate intervention set;

[0033] 2) On the candidate intervention set, a greedy search algorithm with the goal of maximizing the probability of the target event is used to iteratively find the optimal set of intervention events that satisfies the principle of causal minimization.

[0034] 3) Based on the causal graph, extract the causal paths from the events to the target event in the optimal set of intervention events, and use a large language model to generate a natural language executable solution with an explanation of the causal paths.

[0035] Using a large language model to simulate multiple expert roles for causal determination includes:

[0036] Use timing experts to determine the chronological order of events;

[0037] Use mechanistic experts to determine whether there is a causal mechanism between events;

[0038] Use conditional experts to determine whether there are conditional dependencies between events;

[0039] Use counterfactual experts to make counterfactual reasoning judgments;

[0040] The judgments and confidence levels of various experts are summarized to generate a comprehensive causal determination result.

[0041] The directed acyclic graph optimization of the initial causal edge set includes:

[0042] Detect whether a directed cycle exists in the causal edge set;

[0043] If they exist, remove the edge with the lowest confidence or the one with unreasonable temporal logic from the cycle based on the confidence or temporal information of the causal edge, until the graph satisfies the directed acyclic graph constraint.

[0044] The specific method for generating a solution task based on requirements is as follows:

[0045] A scheme generation task is a quintuple. ,in:

[0046] It is a state space, and each state It describes the values ​​of relevant variables in the decision-making scenario;

[0047] It is the space for action, each action It corresponds to one executable operation;

[0048] It is the initial state;

[0049] The goal is usually represented as a predicate about a state. This indicates whether the goal has been achieved.

[0050] It is a set of constraints, including resource constraints, timing constraints, causal constraints, etc.

[0051] A solution It is an action sequence, an execution plan. From the initial state Starting from this point, actions are applied sequentially to generate state transitions:

[0052]

[0053] The plan will succeed if and only if ;

[0054] The specific method for introducing causal models to more accurately characterize the decision-making environment is as follows:

[0055] The event graph uses events as nodes and the relationships between events as edges, which can describe the evolutionary laws of dynamic processes. To support causal reasoning, this application further introduces a causal structure to construct a causal event graph.

[0056] Definition 2: A causal logic graph is a directed graph. ,in:

[0057] It is a collection of event nodes, each event This corresponds to an observable or potentially occurring state change;

[0058] It is a set of edges, including:

[0059] 1) Causal edge express yes The reason;

[0060] 2) Timing edge express What happened Before;

[0061] 3) Other relationships (such as conditions, accompaniments, etc.);

[0062] It is a collection of structure functions for events, each Defined the event How it is determined by its causal events and exogenous factors.

[0063] Furthermore, in order to connect with the structural causal model, each event in the causal event graph is treated as a binary variable. , indicating whether the event occurred; causal edge correspond yes The direct cause; structure function It can usually be represented as a logistic function or a probability function:

[0064]

[0065] Cause and Effect Diagram Corresponding to a structural causal model Graph structure The dependencies between endogenous variables are given, and the structure function is described. The mechanism by which the event occurs is defined.

[0066] Definition 3: Causal Principle Diagram Satisfying the causal Markov property, that is, each event Given its direct cause At that time, it is independent of its non-descendant events.

[0067] This property ensures that causal graphs can faithfully reflect the conditional independence relationships between variables, which is the basis for subsequent causal inference.

[0068] The specific method for generating causally identifiable optimal interventions is as follows:

[0069] Within the causal logic graph framework, solution generation is transformed into finding a set of interventions that maximize the probability of the target event occurring. Intervention corresponds to artificially triggering certain events and severing their original causal inputs.

[0070] Definition 4: Let An intervention plan is a set of interventionable events (i.e., events that decision-makers can actively trigger). and its values This indicates that decision-makers forcibly trigger these events.

[0071] In the intervention plan, the event value is fixed at 1 (triggered), and it does not need to follow the original structure function. Intervention operation The original model Modified to , of which all The structure function for the events is replaced with a constant 1, and all causal edges pointing to these events are cut off.

[0072] Definition 5: Let For the target event (e.g., "crisis resolved" or "successful application of technology"), we aim to maximize the impact of the intervention. The probability of occurrence, i.e.:

[0073]

[0074] The following constraints must be satisfied simultaneously:

[0075] 1) Feasibility constraints: Intervention It must be feasible in reality, meaning that there are no conflicts between the intervention events and that they comply with resource constraints (such as not being able to trigger mutually exclusive events simultaneously).

[0076] 2) Causal identifiability constraint: For any , It must be possible to identify from the observational data that there exists an effective backdoor adjustment set or other identification method to ensure that the intervention effect does not depend on unobserved confounding factors;

[0077] 3) Minimal causality constraint: Intervention plan The principle of causal minimality should be satisfied, i.e., no proper subset exists. Make For any The value is true.

[0078] Definition 6: Refers to an intervention program It is causally identifiable, if for any Intervention effect All can be determined by observed distribution It is uniquely determined by either the backdoor criterion or the frontdoor criterion.

[0079] Based on the above definition, this paper formalizes the interpretable solution generation task into the following causally identifiable optimal intervention generation problem:

[0080] Given a causal logic diagram Interventionable event set Target event and observation data (or a known causal mechanism), solve:

[0081]

[0082] Make It satisfies the constraints of executability, causal identifiability, and causal minimumity.

[0083] This problem is essentially a combinatorial optimization problem, with a search space of . The algorithm needs to be designed to solve or approximate the optimal solution within an acceptable time, while ensuring that the generated solution has good causal properties.

[0084] The beneficial effects of this invention are as follows:

[0085] This application proposes a method for generating interpretable solutions based on causal reasoning graphs and large language models. This method combines the structured causal reasoning capabilities of causal reasoning graphs with the natural language generation capabilities of large language models.

[0086] Event graphs, with events as nodes and relationships between events as edges, can describe the evolutionary patterns of dynamic processes. To support causal reasoning, this application further introduces a causal structure to construct a causal event graph.

[0087] The main contributions of this application include three aspects:

[0088] 1) Formalization of the solution generation problem driven by causal knowledge: The solution generation task is strictly defined as a causal optimization problem on the causal graph. A structural causal model and a counterfactual framework are introduced to lay the foundation for subsequent theoretical analysis.

[0089] 2) Causal Principle Graph Construction Method: A large-scale model-guided causal extraction and fusion algorithm is proposed, which can construct a large-scale, high-coverage causal principle graph from multi-source texts and ensure the quality of the graph through consistency checks.

[0090] 3) Causally identifiable solution generation mechanism: Design a solution generation algorithm based on causal reasoning, prove that the generated solution satisfies the principle of causal minimum (i.e., does not contain redundant intervention) and the backdoor criterion constraint (i.e., the intervention effect is identifiable), and give the computational complexity analysis of the algorithm. Detailed Implementation

[0091] Example 1

[0092] An interpretable scheme generation method based on causal reasoning graphs and large language models is described below:

[0093] 1) Construct an offline causal logic graph;

[0094] 2) Generate online causal identification schemes.

[0095] The construction of the offline causal logic graph includes:

[0096] Step 1: Perform event extraction and normalization;

[0097] Given domain corpus First, an event extraction operation is performed to abstract the core events in the text into a structured representation. Each event... Formalized as triples ,in and The entities that participated in the event. It describes the actions or state changes between entities, providing a unified atomic unit for subsequent causal relationship modeling.

[0098] To improve the standardization and consistency of event representations and reduce semantic sparsity, this paper employs a large language model to achieve event normalization, merging semantically similar events into the same graph node. Specifically, the following prompt template is designed to guide the large language model to complete the standardization transformation:

[0099] System Information Problem Information Response format Please normalize the following event descriptions into a standard form while retaining the core semantics: Input event: {raw_event_text} Output format: (participant, action, object)

[0100] Step 2: Extract causal relationships guided by a large language model using a multi-expert collaborative approach;

[0101] Causal edge identification is a core step in constructing a causal relationship graph. This section proposes a multi-expert collaborative causal relationship extraction mechanism. By simulating domain experts to judge the causal dependencies between events from a multi-dimensional semantic perspective, and combining text analysis to enhance context awareness, it achieves high-precision causal edge extraction and confidence quantification.

[0102] Causal Graph Construction Algorithm Based on Large Language Model Input: Domain corpus Large Language Model Interface Confidence threshold Output: Causal Principle Graph 1: , , 2: for each document do Event Extraction 3: 4: Causal Extraction (Multi-Expert Collaboration) 5: for each event pair do6: 7: if then8: Causal Information Fusion 9: 10: 11: for each do12: 13: return

[0103] Specifically, four complementary expert roles are designed to analyze events from different semantic dimensions. Causal determination:

[0104] 1) Time series expert: Judging events Did it happen? Before;

[0105] 2) Mechanism experts: judgment Is it caused by some mechanism? The occurrence;

[0106] 3) Conditions Expert: Judgment Is it Necessary or sufficient condition;

[0107] 4) Counterfactual experts: judging if It will not happen. Is it still possible?

[0108] Each expert provides an independent judgment and assigns a confidence level. Finally, a panel of experts synthesizes all expert opinions to generate the causal edge and its confidence level. .

[0109] To improve the accuracy of causal extraction, we introduce discourse analysis theory as a guide. The linguistic expression of causal relationships is often implicit in the discourse structure. By identifying discourse markers (such as "because," "leading to," and "therefore"), logical relationships, and context, we can more accurately locate causal links. In our implementation, we combine dependency parsing to identify causal trigger words and use them as contextual enhancement prompts in the large language model.

[0110] Step 3: Integrate the initially extracted causal information.

[0111] The initially extracted causal edges may contain conflicts, redundancies, or missing edges. Therefore, we designed the following fusion and optimization steps:

[0112] 1) Conflict resolution: For and For the cyclic edges, retain those with higher confidence, or determine the direction based on time series information;

[0113] 2) Transitive closure: If and Then supplement However, it is marked as an indirect cause.

[0114] 3) Directed Acyclic Graph Constraint: Ensures the final causal graph is a directed acyclic graph. If a cycle is detected, remove the edge with the lowest confidence based on the confidence level.

[0115] 4) Structure function learning: For each event Based on its set of parent nodes Learn the structure function from the observed data. When data is plentiful, logistic regression or Bayesian network parameter learning can be used; when data is sparse, a large language model can be used to generate reasonable function forms (such as logical AND, OR, probability sum, etc.).

[0116] The online causality-identifiable generation scheme includes:

[0117] Step 1: Identify pruning in the intervention set;

[0118] According to Definition 6, only interventions that meet the causal identifiability requirement should be considered. Using the backdoor and frontdoor criteria, we can pre-identify which interventions are identifiable.

[0119] Theorem 1: Given a cause-effect graph and target Intervention causal effect It is identifiable, if for each There exists an adjustment set They satisfy either the backdoor criterion or the frontdoor criterion, and these adjustment sets can be computed from the observation data.

[0120] The above theorem can be proven based on Pearl's causal graph identification theory, if each univariate intervention is identifiable, and If there are no unblocked obfuscated paths between variables, then joint intervention can also be identified.

[0121] Based on this theorem, we can pre-calculate each interventionable event. Univariate identifiability and construct identifiable intervention families. If and only if And all its subsets belong to hour Only those that are retained can significantly prune the search space.

[0122] Step 2: Greedy search based on causal effects;

[0123] Identifiable intervention clusters after pruning The above adopts a greedy forward search strategy to approximate the optimal intervention scheme. The core idea is to successively add intervention events with the largest causal effect gain until the convergence condition is met, balancing solution efficiency and optimality of the scheme.

[0124] The algorithm starts with an empty intervention scheme as the initial state. The effective intervention set after causal identifiability pruning. Maintain the current optimal intervention plan By calculating candidate intervention events one after another. Corresponding causal effect gain Update the event that yields the largest gain and passes the counterfactual necessity check. Simultaneously, a causal minimum test is performed to eliminate redundant interventions with equivalent sub-solutions, until the effect gain of the newly added intervention is reached. ( The iteration terminates when a preset convergence threshold is reached, and the final output is an approximately optimal structured intervention scheme that satisfies the constraints. .

[0125] Step 3: Natural language processing scheme generation.

[0126] The greedy search yields a structured set of intervention events, which needs to be transformed into a natural language solution that is human-understandable and actionable in the given scenario, enabling the implementation from causal intervention to practical decision-making. This step uses a causal event graph as a basis, combined with the generation capabilities of a large language model, to enhance causal interpretability while ensuring the feasibility of the solution. The specific implementation steps are as follows:

[0127] 1) Intervention ranking: Based on the directed acyclic structure of the causal logic graph, the optimal intervention plan is ranked. The events in the process are topologically sorted to avoid logical conflicts;

[0128] 2) Causal chain explanation: For each intervention event, extract the target event from the causal logic graph. The core causal path is identified, clarifying the mechanism and transmission chain of the intervention event's effect on the target outcome;

[0129] 3) Counterfactual analysis: Optionally generate counterfactual scenarios of "if a certain intervention were not taken" to enhance interpretability.

[0130] The sorted intervention sequence, causal path analysis, counterfactual analysis results, and execution constraints are integrated as input to guide the large language model in generating a clear and logically rigorous natural language solution. The prompt template design for the large language model is as follows:

[0131]

[0132] Example 2

[0133] Generation of cybersecurity incident response solutions based on causal reasoning graphs

[0134] 1. Scenario and Problem Definition

[0135] Area: Cybersecurity Incident Response

[0136] Target event (T): (Network system, recovery, normal service), i.e., "Network system resumes normal service".

[0137] Initial state: The company's intranet has been attacked by ransomware, some critical servers have been encrypted, and business operations have been interrupted.

[0138] Input: Unstructured domain corpus D, including cybersecurity reports, threat intelligence articles, emergency response plan texts, and historical event logs.

[0139] Core mission: Automatically generate an executable and interpretable emergency response plan to guide security personnel through the steps and restore the system in the most efficient and reliable way.

[0140] 2. Offline Phase: Construction of a Causal Graph in the Field of Cybersecurity

[0141] Step 1: Event Extraction and Normalization

[0142] Cybersecurity events are extracted from the input corpus D using a Large Language Model (LLM).

[0143] Original text: "The attacker delivered a malicious attachment via a phishing email, which triggered ransomware execution when an employee clicked on it."

[0144] Extracted and normalized events:

[0145] (Attacker, delivery, phishing email)

[0146] (Employee clicked on the malicious attachment)

[0147] (Ransomware, execution, encryption operations) (This is a simplified representation; the actual details may be more precise.)

[0148] Semantic normalization can be achieved through LLM, for example, unifying "ransomware activated" and "ransomware started running" into (ransomware, execution, encryption operation).

[0149] Step 2: Causal Relation Extraction Guided by a Large Language Model

[0150] For the extracted event pairs, LLM simulations are used to determine causality using four types of experts:

[0151] Timing expert: Determines that (employee, click, malicious attachment) occurred before (ransomware, execution, encryption operation).

[0152] Mechanism experts: Clicking on malicious attachments is the mechanism that triggers ransomware execution.

[0153] Conditional / counterfactual expert: asserts that "the ransomware may not execute if the malicious attachment is not clicked."

[0154] Based on expert opinions, generate causal edges with high confidence, for example:

[0155] (Employee, click, malicious attachment) -> (ransomware, execute, encryption operation), confidence level 0.92.

[0156] (Ransomware, execution, encryption operations) -> (Business applications, interruption, service), confidence level 0.95.

[0157] Step 3: Causal Information Fusion

[0158] Conflict resolution: If contradictory edges exist simultaneously, one edge is retained based on confidence level and time sequence.

[0159] DAG constraint: Ensures the graph is acyclic. For example, if a cycle of "service interruption -> insufficient security awareness training -> click on phishing emails -> service interruption" occurs, the edge with the lowest confidence level is pruned.

[0160] Structure function learning: Based on historical data or expert knowledge, define the logic for an event to occur. For example, business application interruption = ransomware execution OR (network device, occurrence, hardware failure). Here, the structure function f can be a logical OR gate.

[0161] 3. Online Phase: Emergency Response Plan Generation

[0162] Input: Current alert — (ransomware, execution, encryption operation) has occurred, target T is (network system, recovery, normal service).

[0163] Step 1: Pruning of the identifiable intervention set

[0164] Intervention-proactive event set E_l: Identifies events from the graph that the security team can proactively act upon, such as:

[0165] e1: (Security team, quarantine, infected host)

[0166] e2: (Security team, enable, restore from backup)

[0167] e3: (Security team, source tracing, attack path)

[0168] e4: (Security team, patching related vulnerabilities)

[0169] Identifiability determination: Applying the backdoor criterion. For example, the effect of intervention e2 (enabling backup) on target T (recovery service) may be influenced by the confounding factor of "backup availability." If "backup availability" is an observable variable, the causal effect can be calculated by using it as an adjustment set, and intervention e2 is identifiable. If the variable is completely unobservable, e2 may have been pruned.

[0170] Step 2: Greedy Search Based on Causality

[0171] Initialization: Empty scheme π = {}, current effect P(T|do(π)) is extremely low (system is in an interrupt state).

[0172] First iteration: Calculate the individual causal effect gain for each candidate intervention.

[0173] ΔP(e1): Isolating the host can prevent the spread and may slightly increase the probability of eventual recovery.

[0174] ΔP(e2): Restoring from backup is a direct solution with huge gains.

[0175] ΔP(e3): Tracing the source does not directly help the current recovery, so the gain is 0.

[0176] Choose e2, which has the largest gain, and add it to the scheme, π = {e2}.

[0177] Second iteration: Based on the existing e2, calculate the marginal gain of adding new interventions.

[0178] ΔP(e1|e2): Isolating the host again when recovery from backup is already planned can prevent reinfection during the recovery process and still provides a significant benefit.

[0179] ΔP(e4|e2): Patching vulnerabilities is useful in preventing the next attack, but has little marginal benefit for the current recovery.

[0180] Choose e1, which has the largest gain, and add it to the scheme, π = {e2, e1}.

[0181] Convergence criterion: If the marginal gain of subsequent interventions (such as e3, e4) on the current goal of "restoring services" is lower than the threshold ε, the search stops.

[0182] Minimalism check: Check if {e2, e1} is the minimum. It is found that if only e2 (recovery) is performed without e1 (isolation), the device may be encrypted again during the recovery process, causing P(T|do({e2})) to be much lower than P(T|do({e2, e1})). Therefore, {e2, e1} is the causal minimum.

[0183] Output the optimal intervention set: π* = { (security team, enable, backup for recovery), (security team, isolate, infected host)}

[0184] Step 3: Natural Language Scheme Generation

[0185] Enter LLM:

[0186] Target event T: The network system resumes normal service.

[0187] Intervention event π*: [Enable backup and recovery, isolate infected host].

[0188] Causal path explanation:

[0189] "Isolating infected hosts" will sever the causal path of "ransomware execution -> service interruption" and prevent the impact from spreading.

[0190] "Enable backup and restore" will directly create a new causal path "restore data from backup -> restore system services", thereby achieving the goal.

[0191] LLM-generated solution text:

[0192] Cybersecurity Emergency Response Plan

[0193] Objective: To restore normal service to network systems encrypted by ransomware.

[0194] step:

[0195] Immediately isolate the infected host: Physically or logically disconnect the encrypted server from the network to prevent ransomware from spreading laterally and protect intact systems and backup servers. (Purpose: To break the causal chain of threat spread and create a safe environment for recovery)

[0196] Restore data and services from a clean backup: Verify the integrity of the most recent, uninfected backup copy and then restore it to an isolated or new server. (Purpose: This is the core operation that directly achieves the goal of "service recovery," reversing damage directly by replacing encrypted data.)

[0197] Follow-up recommendations: After the recovery is complete, conduct attack attribution and vulnerability patching to prevent similar attacks in the future.

[0198] This embodiment demonstrates the application of the present invention in the field of network security, achieving the following beneficial effects:

[0199] Explainability: Each step of the generation process is accompanied by an explanation based on causal graphs (such as "breaking the chain of threat propagation"), enabling decision-makers to understand not only what happened, but also why it happened.

[0200] Causal reliability: The plan strictly follows the causal logic of "isolation before recovery", avoiding the common-sense error of "direct recovery in an infected environment leading to reinfection".

[0201] Automation and Efficiency: Automatically construct threat maps from massive amounts of threat intelligence and quickly generate customized solutions when an incident occurs, significantly shortening the time to response (MTTR).

[0202] Theoretical rigor: Through "identifiability" pruning, it is ensured that the recommended "enable backup" operation is proposed on the premise that the availability of backup can be assessed, thus avoiding blindly suggesting ineffective operations.

[0203] In summary, the above examples fully demonstrate the practical application of the core technologies (causal graph construction, identifiability pruning, greedy search, and NL generation) in a specific field (network security).

[0204] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. The various components mentioned in this invention are common technologies in the existing field. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for generating interpretable solutions based on causal reasoning graphs and large language models, characterized in that: Step 1: Generate a solution task based on the requirements; Step 2: Introduce a causal model to more accurately characterize the decision-making environment and construct an offline causal event graph; Step 3: Incorporate the causally identifiable optimal intervention scheme to generate an online causally identifiable scheme; The steps for constructing an offline causal event graph are as follows: Based on the domain corpus, events are extracted and normalized using a large language model to construct event nodes, and causal relationships are extracted and fused under the guidance of the large language model to construct causal edges, thus forming a structured causal event graph. The steps for generating an online causal identifiable solution are as follows: Based on the causal event graph, the set of interventionable events is pruned for causal identifiability; the optimal intervention solution is searched on the pruned intervention set; and the optimal intervention solution is transformed into a natural language solution with causal explanation.

2. The method for generating interpretable solutions based on causal reasoning graphs and large language models according to claim 1, characterized in that, Step two includes the following steps: 1) Use a large language model to extract events from the domain corpus and perform semantic normalization to obtain a standardized set of event nodes; 2) Employ a large language model to simulate multiple expert roles, and make causal judgments on event pairs from multiple dimensions such as time sequence, mechanism, condition, and counterfactual, and extract causal relationships with confidence to construct a preliminary causal edge set; 3) Perform conflict resolution and directed acyclic graph optimization on the preliminary causal edge set, and learn the structure function of the events to form a causal event graph that conforms to the form of a structural causal model.

3. The method for generating interpretable solutions based on causal reasoning graphs and large language models according to claim 1, characterized in that, Step three includes the following steps: 1) Based on the backdoor criterion or the frontdoor criterion, select a subset of interventions with identifiable causal effects from the set of interventionable events as a candidate intervention set; 2) On the candidate intervention set, a greedy search algorithm with the goal of maximizing the probability of the target event is used to iteratively find the optimal set of intervention events that satisfies the principle of causal minimization. 3) Based on the causal graph, extract the causal paths from the events to the target event in the optimal set of intervention events, and use a large language model to generate a natural language executable solution with an explanation of the causal paths.

4. The method for generating interpretable schemes based on causal reasoning graphs and large language models according to claim 2, characterized in that, Using a large language model to simulate multiple expert roles for causal determination includes: Use timing experts to determine the chronological order of events; Use mechanistic experts to determine whether there is a causal mechanism between events; Use conditional experts to determine whether there are conditional dependencies between events; Use counterfactual experts to make counterfactual reasoning judgments; The judgments and confidence levels of various experts are summarized to generate a comprehensive causal determination result.

5. The method according to claim 2, characterized in that, The directed acyclic graph optimization of the initial causal edge set includes: Detect whether a directed cycle exists in the causal edge set; If they exist, remove the edge with the lowest confidence or the one with unreasonable temporal logic from the cycle based on the confidence or temporal information of the causal edge, until the graph satisfies the directed acyclic graph constraint.

Images